CVE-2016-6293

The uloc_acceptLanguageFromHTTP function in common/uloc.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ does not ensure that there is a '\0' character at the end of a certain temporary array, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long httpAcceptLanguage argument.

• CWE-119

• http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=aa82e99ed8003c01f1ef4f0940e56b85c5b032d4
• http://openwall.com/lists/oss-security/2016/07/24/2Mailing List
• http://www.securityfocus.com/bid/92127Third Party Advisory, VDB Entry
• https://bugs.php.net/72533Exploit, Issue Tracking, Third Party Advisory
• https://security.gentoo.org/glsa/201701-58Third Party Advisory
• https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
• http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=aa82e99ed8003c01f1ef4f0940e56b85c5b032d4
• http://openwall.com/lists/oss-security/2016/07/24/2Mailing List
• http://www.securityfocus.com/bid/92127Third Party Advisory, VDB Entry
• https://bugs.php.net/72533Exploit, Issue Tracking, Third Party Advisory
• https://security.gentoo.org/glsa/201701-58Third Party Advisory
• https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Published

Jul 25, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6287The "http-client" egg always used a HTTP_PROXY environment v…
• CVE-2016-6288The php_url_parse_ex function in ext/standard/url.c in PHP b…
• CVE-2016-6289Integer overflow in the virtual_file_ex function in TSRM/tsr…
• CVE-2016-6290ext/session/session.c in PHP before 5.5.38, 5.6.x before 5.6…
• CVE-2016-6291The exif_process_IFD_in_MAKERNOTE function in ext/exif/exif.…
• CVE-2016-6292The exif_process_user_comment function in ext/exif/exif.c in…
• CVE-2016-6294The locale_accept_from_http function in ext/intl/locale/loca…
• CVE-2016-6295ext/snmp/snmp.c in PHP before 5.5.38, 5.6.x before 5.6.24, a…
• CVE-2016-6296Integer signedness error in the simplestring_addn function i…
• CVE-2016-6297Integer overflow in the php_stream_zip_opener function in ex…
• CVE-2016-6298The _Rsa15 class in the RSA 1.5 algorithm implementation in …5.3
• CVE-2016-6299The scm plug-in in mock might allow attackers to bypass the …